Why isn't the the Referer header removed for Google HTTPS -> HTTP?

Question

Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol.” htt

Answer 1

When you do a Google Search with Google Chrome, the following tag appears in the search results:

<meta content="origin" id="mref" name="referrer">

The origin value means that instead of completely omitting the Referer when going to http from https, the origin domain name should be provided, but not the exact page within the site (e.g. search strings will remain private).

---

On the other hand, link aggregators like lobsters have the following, which ensures that the whole URL will always be provided in the Referer (by browsers like Chrome and Safari), since link stories are public anyways:

<meta name="referrer" content="always" />

---

As of mid-2014, this meta[@name="referrer"] is just a proposed functionality for HTML5, and it doesn't appear to have been implemented in Gecko, for example -- only Chrome and Safari are claimed to support it.

http://smerity.com/articles/2013/where_did_all_the_http_referrers_go.html

https://bugzilla.mozilla.org/show_bug.cgi?id=704320

http://wiki.whatwg.org/wiki/Meta_referrer

Answer 2

cnst answers this correctly above; it's content="origin". That forces browsers going HTTPS->HTTPS and HTTPS->HTTP to have the request header:

http-referer=https://www.google.com  

This functionality allows sites to get credit for traffic without leaking URL parameters to a third party. It's awesome, as it's so much less hacky than what people have used here in the past.

There are currently three competing specs for this. I don't know which one is authoritative, and suspect it's a mix. They're similar, on most points.

• http://www.w3.org/TR/referrer-policy/
• http://w3c.github.io/webappsec/specs/referrer-policy/
• https://wiki.whatwg.org/wiki/Meta_referrer

Here's available support, that I know of; would love for people to let me know if I'm wrong or missing anything.

Now:

• Chrome 17+ supports this on desktop
• Chrome 25+ for mobile devices
• Safari 6 on iPad and iPhone

Unknown version:

• Desktop Safari 7 supports this; possible support in earlier versions, but I don't have a browser to confirm.

Upcoming real soon now:

• IE12 Beta has working support (new this week).
• Firefox 38 has the code checked in for a May 2015 release. https://bugzilla.mozilla.org/show_bug.cgi?id=704320

Answer 3

I think its because Google uses

<meta name="referrer" content="always">

So when a person goes from HTTPS to a HTTP site, the referrer is kept. Otherwise, without this the referrer would be stripped.